A chosen IV attack against Turing

Abstract

In this paper, we show that the key scheduling algorithm of the recently proposed stream cipher Turing suffers from important flaws. These weaknesses allow an attacker that chooses the initialization vector (IV) to recover some partial information about the secret key. In particular, when using Turing with a 256-bit secret key and a 128-bit IV, we present an attack that requires the ability to choose 237 IV and then recovers the key with complexity 272, requiring 236 bytes of memory. © Springer-Verlag Berlin Heidelberg 2004.